Privacy statement for students and applicants

This data privacy policy describes how Nord University processes your personal data as well as your rights and obligations associated with such processing.

Main body

What is a Data Privacy Policy?

This data privacy policy describes how Nord University processes your personal data. The purpose of this Data Privacy Policy is to inform you of what personal data is being processed, how it is processed, who is responsible for the processing, the rights you have and who you can contact.

What is considered personal data?

Personal data is any kind of data, information, facts and assessments that can be linked to you as an individual, cf. GDPR article 4 no. 1. What determines whether a piece of information is personal data is whether the data can be linked to an identified or identifiable physical person.

Data that on its own cannot be linked to an individual person may constitute personal data if they indirectly identify a person in connection with other data.

What is the purpose of and basis for processing of my data?

PurposeThe purpose of the processing of personal data is to protect your rights as an applicant, a student, a course participant or a Ph.D candidate, and to fulfil the institution's duties and obligations according to the Universities and University Colleges Act.

For example, the processing of personal data is necessary to enable Nord University to:

process your application for admission to a programme of study/exam/course

perform necessary administration related to your studies and to you as a student

document your course results

Legal basisThe processing has legal basis in the University- and University College Act section 4-15 and GDPR art. 6 no. 1 letter e and no. 3 letter b. The processing is necessary in order to exercise public authority, and to fulfil and comply with provisions of the University- and University College Act. Processing is also necessary in order for the institution to be able to protect your interests as a student in the best possible way. In some cases, the institution has also chosen to supplement the legal basis with consent statements for the processing of certain types of data.

Brief description of the Common Student System (FS)

The Common Student System (FS) is a study administration system developed for universities, specialized university institutions, and state university colleges. The system is also available to private colleges. When you apply for admission, and when you are a student at Nord University, your personal data will be registered, processed and stored in FS.

A number of applications are linked to the FS study administration. This means that data registered in these applications is also stored in FS. In different connections, the data in FS is reported to a number of parties/enterprises

What kind of personal data does Nord process?

In some cases, we may also process sensitive data about you. Processing of an application for adaptation or leave of absence for health reasons, and processing of a disciplinary case or a suitability assessment, are examples of instances where this may be necessary. As of today, sensitive personal data about you is neither processed nor stored in FS.

1.-4. It is voluntary for you to record personal data in Samordna opptak, the application portals Søknadsweb, EVUweb and Studentweb, but without your personal data, we may not be able to process your applications. In the application portal of Samorda opptak, Søknadsweb and EVUweb, you can record information about yourself related to applications for study/course registrations. In Studentweb you can record information on yourself related to applications for programmes of study, information on your background, registration for education and exams, applications, documents you upload. This data may be necessary in order for us to process your applications and for you to be able to study at Nord University.

5.-6. Submitting any personal data to us via social media or the chat feature on our website is done on a voluntary basis. Nord University has a data processing agreement in place with Socialboards in relation to the delivery of the chat service. Any personal data that you provide via the chat feature will be processed in accordance with GDPR and will be deleted within 12 months. You should not submit any sensitive data to us via the chat feature or social media.

7. National Diploma Database (NVB)If you apply for admission to Nord University via Søknadsweb, you can consent to us collecting your personal data from the National Diploma database. The National Diploma database contains most electronic diplomas from upper secondary schools issued in the year 2000 or later. If you give your consent, we collect your name, your identity number (11 digits), the names of schools, subjects and grades.

8. Other Universities/University CollegesA) Have you achieved results at other educational institutions in Norway?If you are applying for admission to Nord University and have achieved results at another university/college that also uses FS, you can consent to the exchange of results. If you give your consent, an executive officer can collect all of your results from all institutions in Norway that use FS. In practice, this means most universities and university colleges in Norway, except for the Norwegian School of Business BI. We refer to your institution's Data Privacy Policy for more information regarding the processing of your personal data.EMREX – results from universities/colleges outside NorwayIf you have achieved results from a university/college outside Norway that participates in the EMREX cooperation, you can bring your results with you to Nord University. You can do this via Søknadsweb and Studentweb.c) Registry of banned students (RUST)If a Norwegian educational institution has decided to apply sanction(s) to you, that also affect your application-/student relationship with other Norwegian educational institutions (according to sections 3-7(8), 4-8(1) to (3) or (4)-10(3) of the University and University Colleges Act), Nord will receive personal data about you through RUST. Only a few selected people at Nord University will have access to these personal data. More information is available in the RUST Data Privacy Policy.

9. Contact- and Reservation Register (KORR)FS can obtain your e-mail address and your mobile number from the Contact and Reservation Register (KORR). If you do not want anyone to be able to obtain your contact information from KORR, you may opt out of this in KORR. You can find more information on the website of the Agency for Public Management and eGovernment.

Registrations made without your explicit consent7. National Diploma Database (NVB)If you apply for admission to Nord University via Samordna opptak, we will collect your personal data from the National Diploma Database. The National Diploma database contains most electronic diplomas from upper secondary schools issued in the year 2000 or later. We can then collect your name, your identity number (11 digits), the names of schools, subjects and grades.

10. Other people who registrate you in EVUwebIn some cases, employers and others register information about you in EVUweb. This usually happens if you are to follow a programme of study or participate in continuing/further education at Nord University on behalf of your employer. This information may be required in order for us to process an application/enrolment for admission to a programme of study/course.

11. Other people who registrate you in NominationNomination is a web application whereby external institutions can nominate exchange students for admission to Norwegian educational institutions. If you have been nominated in Nomination, you will have already been informed of this by e-mail. The following personal data is registered in Nomination and is then transferred to FS: first- and last name, gender, e-mail address, date of birth, citizenship and what you are nominated for. The nominator can also upload any documents along with the nomination. Persons who have been nominated can view their personal data, and any documents, in Søknadsweb.

12. Executive officers at Nord UniversityIn some cases it is necessary for executive officers at Nord University to record information on you associated with your studies. Examples of this might be assessments related to application for admission, reasons for- and appeal against examination results, registrations related to completion of studies. It might also be related to disciplinary matters, suitability assessments and adaptation issues.

13. Teaching at Nord UniversitySome of the teaching/tuition may be recorded or streamed.

14. The Norwegian National Population RegisterIn order for your name and address to be correctly registered in FS, we collect your name and address from the National Population Register.

15. Norwegian State Educational Loan Fund
The Norwegian State Educational Loan Fund sends Nord University lists of all its students who are registered as customers. They do this in order for us to know which persons’ personal data will be submitted to the Norwegian State Educational Loan Fund in connection with the payment of a loan. Please read point 8.6 further down.

16. Digital Exam System
More and more exams are being conducted in digital exam systems. Your exam results and an explanation of grades, which are recorded in the exam systems of subject teachers and external examiners, are sent to FS.

17. Fagpersonweb
As with the digital exam system, your exam results and an explanation of grades can also be recorded in Fagpersonweb. Fagpersonweb is a web application used by subject teachers and external examiners. In addition to exam results and an explanation of grades, attendance records can also be registered in Fagpersonweb. Your personal data that is recorded in Fagpersonweb, is sent to FS.

18. User Administrative systemIn order for you to be given an IT account at Nord University and to obtain access to our IT services, your personal data is recorded in our user administrative system. We register your name and your ID number (11 digits), where you are a student (Faculty/Department), all addresses, telephone numbers, e-mail addresses, student number.

19. Economy systemPayment of the Nord University term fee, course fees and other student fees are processed in Agresso. This means that the following personal data is sent from FS to Agresso: student number, personal name, customer group, all telephone numbers, all addresses, e-mail addresses and URL (web link) If you are registered with these.

20. CRIStin (Current Research information system in Norway)If you are a research fellow and an employee of Nord University, the following personal data will be transferred from the HR system at Nord University to CRIStin:• ID number• Name• Position• Gender• Age• Faculty AffiliationIn addition, you can also yourself register your research in CRIStin.

Automated processing of data

When you apply for admission to Nord University, a number of administrative procedures are carried out partially- or wholly automatically in the processing of your application. This applies to the following cases:

• assessment of whether you are eligible for admission• calculation of points on admission
• acceptance to a programme of study• calculation of who can register for which subjects (via Studentweb)• enrolment for teaching and exam, and allocation of place on study courses with limited capacity• control of education plan• creating invoices• calculation of obtained qualification on completion of a course of study• withdrawal of admission to a course of study due to low study progression• calculation of total grade for subjects that include exams

How long does Nord store my personal data?

In general, personal data will not be stored longer than necessary. It is the data controller’s responsibility to assess how long it is necessary to have the data available. In some cases, we are obliged to store the data for a certain period of time in accordance with national legislation.

Even if we delete personal data in our data processing systems, the Archives Act will in many cases require that the data should be archived.
As a general rule, all your personal data is stored indefinitely in the Common Student System (FS). However, there are some exceptions:

Documents on applicants who apply through Samordna opptak, but are not allocated a place on a course of study, will be deleted once admission has been completed.

Personal data relating to sanctions cf. sections 3-7 (8), 4-8 (1) to (3) or 4-10 (3) of the University- and University Colleges Act, will be deleted automatically from FS six months after expiry of the sanction period.

If Nord University receives information that you have died, we will delete your contact information. In such a case, any applications for admission, registration for programmes of study, courses and exams etc. will be withdrawn.

Nord can disclose your data to others

Distribution or export of data is defined as any release of data other than to its own system/processing, or to the data subject itself or someone who receives data on its behalf.

Nord University can distribute or export data that contains personal data to other systems, i.e. to an external data processor, whenever it is deemed necessary.

As a general rule, personal data will not be transferred to countries outside the EU/EEA, or to certain international organisations. The exception is if you are a borrower at the University library. In this case, your personal data will be transferred to Israel via our subcontractor ExLibris GmbH. Israel is on the European Commission's list of approved countries with adequate data protection. Your personal data may also be exported to countries outside the EU/EEA in connection with an exchange stay.

Your personal data may be exported to the following parties/enterprises:

The Norwegian Directorate for ICT and Joint services in Higher Education and Research, Unit (Supplier of FS)

University Centre for Information Technology (USIT) at the University of Oslo (UiO) (operates FS)

(NSD) The Norwegian Centre for Research Data, and (DBH) National Database for Higher Education Statistics in Norway

(NIFU) Nordic Institute for Studies in Innovation, Research and Education

The Norwegian Directorate of Health

Other parties that are entitled to have access to your personal data according to the Freedom of Information Act

Internship locations - such as health enterprises, municipalities and other partners that offer internships

Internationalization (Exchange)

Facebook Custom Audience

Unit, The Norwegian Directorate for ICT and Joint Services in Higher Education and Research.FS is developed by Unit. Employees of Unit who need access to your personal data in connection with their work.

University Center for Information Technology (USIT) at the University of Oslo (UiO)FS is operated by USIT at UiO. Employees of USIT who need access to your personal data in connection with their work.

The Student Welfare Organisation at NordIf you have paid the semester fee for the current semester, or have been awarded a place on a programme of study in the past two months, the Student Welfare Organisation at Nord can retrieve your personal data from Nord University. This is so that they can verify that you are a student, and that you are entitled to a student discount on the Student Welfare Organisation’s services. The Student Welfare Organisation can retrieve your ID number (11 digits), your name, when you last paid the semester fee and the ID on your student card.

Student organisations affiliated with Nord UniversityIn connection with the start of studies and various events organised by the student organizations, we supply your name and your programme of study to student organizations.

Nord University’s access control systemYour personal data will be registered in the University's access control system in order for you to access the University’s buildings and rooms during your studies, using the student card. Students who want student cards can obtain photos from either the Service Centre or the photo booth. The photo on active student cards and key cards is stored in FS and the same photo is transferred to the mobile app Student I.D., for students who choose to use this.

Computas (supplier of the Student I.D. app)If you are a student at Nord University, have registered for the semester and paid the semester fee, you can download the Student I.D. app. The app is proof that you are a student. Your personal data is only sent to the app when you log into the app with your Nord user name and password (Feide). The Student I.D. app shows your name, study location, and whether you have paid the semester fee and registered for the current semester. The app also shows the photo that Nord University has taken of you for use on your student card. You download the app and log in yourself, and you have control of who the digital student I.D. is shown to. You can choose whether to use the app or not.

The Norwegian National Population RegisterNord University sends the following personal data about you to the National Population Register: name, I.D. number (11 digits), and address. We do this once a year to ensure that your personal data is brought up to date.

The Norwegian State Educational Loan FundIf you are a customer of the Norwegian State Educational Loan Fund, information about you will be submitted to them as soon as you are registered as a student. The following personal data will be transferred to the Norwegian State Educational Loan Fund once a day: I.D. number/D number (11 digits) and the University/University College to which you are admitted as a student.If you have taken an exam and/or received prior approval of foreign education or study abroad, your personal data will be sent to the Norwegian State Educational Loan Fund. The following personal data is transferred to the Norwegian State Educational Loan Fund once a day: I.D. number/D number (11 digits), at which University/University College you have taken the exam, your exam results (pass/fail/not graded, if passed: also your grades).We transfer your personal data to the Norwegian State Educational Loan Fund so that you do not need to prove your student status and exams taken.

User Administrative SystemIn order for you to be given an IT account at Nord University and to obtain access to our IT services, your personal data must be recorded in our user administrative system, Active Directory Users and Computers. In this connection, we send personal data, such as address information, photo, group affiliations, and information on registration for programmes of study and exams from FS to Active Directory Users and Computers.

Archiving systemIf you have an application and/or decision process ongoing at Nord University, this will be recorded in the University's archiving system. The following personal data will be recorded:
- name- address- e-mail- phone numberDocumentation that is attached to applications is also stored here.

Canvas (supplier of learning management system)At Nord University, Canvas is used in connection with teaching. This means that Canvas, which develops and operates Canvas will have access to the following personal data on you:- name- e-mail- your courses and programme of study

Canvas also contains some of your submissions, individual feedback from the subject teacher, debate posts (forums) and various types of messages/alerts.

Digital Exam SystemThe Inspera assessment system is used for a number of exams at Nord University. In order for you to be able to take a digital exam, we will send some of your personal data to Inspera Assessment. Inspera, which develops and operates Inspera Assessment will have access to the following
personal data on you: name

Plagiarism Detection SystemAt Nord University, the Urkund plagiarism detection system is used to detect cheating ("literary theft") in exams or compulsory assignments. The system will have access to the following personal data on you:- name- student number- e--mail address

Timetable SystemAt Nord University, the TimeEdit timetable system is used to plan teaching and exams. TimeEdit, which develops and operates TimeEdit will have access to the following personal data on you:- name- e-mail- phone number- your courses, programme of study and your study location

Learning management system and timetable system integration servicesIn order to be able to use systems such as TimeEdit and Canvas, personal data is transferred from FS to these systems. Kong Arthur, which develops and operates such integration services that transfer data between systems ,will have access to your personal data.

Crisis and Emergency PreparednessAt Nord University, CIM is used as a tool for information sharing in connection with accidents and undesirable incidents. It is also a warning and mobilization system. Therefore, in order to be able to notify you as a student of undesirable incidents, we transfer the following personal data:- name- phone number- e--mail address- campus
- internship location- information on next of kin

Other Universities/University Colleges

Application for admission through Samordna opptak

When you apply for admission to Nord University via Samordna opptak, in most cases your application will be processed by Nord University. If you have applied for admission to one or more other Universities/University Colleges, it is possible that they will process your application on behalf of all the Universities/University Colleges to which you have applied. In such a case, they will process and store personal data on you relating to your application(s). Your application will mainly contain personal data that you have registered in the applicant portal of Samordna opptak.

Consent to exchange of results

You can consent to the exchange of results, if you have obtained results from assessments and degrees from a University/University College and would like to use these results in connection with an application for admission to another Norwegian University/University College. If you give your consent, an executive officer can collect all of your results from all institutions in Norway that use FS. In practice, this means most Universities and University Colleges in Norway, except for the Norwegian School of Business BI. We refer to your institution's Data Privacy Policy for more information regarding the processing of your personal data.

Approval of foreign education

If you have applied for the approval of foreign education, the case details linked to the application, including your personal data, will be transferred to GAUS - search service for the Approval of Foreign Studies. Other Universities/University Colleges in Norway have access to search for and view your personal data in GAUS. More information is available in the GAUS Data Privacy Policy.

Decisions on sanctions related to behaviour

In the event that Nord University has decided to apply sanctions fo you, this decision will in many cases be transferred to RUST (Register for Banned Students). Decisions on sanctions are related to one or more of the following: use of false diplomas, disturbing/troublesome behaviour, dangerous behaviour, gross breach of confidentiality, improper behaviour in practical or clinical teaching, cheating, attempts at cheating, complicity in cheating, or exclusion following a suitability assessment. If, during the sanctions period, you have applied for admission to another Norwegian University/University College, your personal data will be sent to the relevant institution. Only a limited number of people at this institution will then be able to access your personal data. In certain cases this also applies if you are registered for exams. More information is available in the RUST Data Privacy Policy.

NOKUT- Norwegian Agency for Quality Assurance in Education

Approval of foreign studies

If you have applied for the approval of foreign education, the case details linked to the application, including your personal data, will be transferred to GAUS - search service for the Approval of Foreign Studies. NOKUT has access to search for and view your personal data in GAUS.

BIBSYS/other library system providerIn order to be registered as a borrower at Nord University and to use the library services, we send your personal data to BIBSYS/other library system. This happens only when you are registered for a semester and have paid the semester fee.

Statistics Norway (SSB)In several cases, Nord University sends your personal data to SSB for statistical purposes. This is personal data related toyour semester registration
- your exam result(s)- your completed study programme- your achieved qualification(s) which result in the award of a diploma- you and your admission to a Ph.D programme

(NSD) The Norwegian Centre for Research Data, and (DBH) National Database for Higher Education Statistics in Norway In several cases, Nord University sends your personal data to NSD and DBH for research and statistical purposes. This is personal data related to
your application for admission to programmes of study:- your semester registration, paid semester fee and registration(s) for subject(s)
- your exams- your obtained qualification(s)- your exchange(s)- whether you have achieved credits according to your educational plan- you and your Ph.D programme

NIFU- Nordic Institute for Studies in Innovation, Research and EducationIn several cases, Nord University sends your personal data to NIFU for research purposes. This is personal data related to your Master's degree (in some cases your Bachelor's degree), and your Ph.D degree.

The Norwegian Directorate of HealthIf you have completed a study programme, which can grant authorization or a license according to the Health Personnel Act or Animal Welfare Personnel Act, Nord University will send your personal data to the Norwegian Directorate of Health/Register for Health Personnel (HPR). Relevant personal data includes your name, I.D. number (11 digits), information on your study programme, and the qualification you have achieved. Thus you do not need to apply for authorisation when you have completed such a study programme.

Disclosure of personal data according to the Freedom of Information ActIn the event that Nord University receives applications for access to personal data according to the provisions of the Freedom of Information Act, the provisions of the Personal Data Act will not set any restrictions to this right of access. It may therefore be the case that Nord University sends personal data about you to other parties other than those stated in this Data Privacy Policy.

Internship Locations Health enterprises, municipalities and other partners that offer
internships. In studies that include internships, it may be the case that we send the following personal data on you to the internship location: name, I.D. number, subject code, phone number, and address.

Internationalization In the event that you are to participate in an exchange programme during your studies, we will send the following personal data to a foreign institution:
- name- ID number- e-mail address
- address- phone number- bank account number- student number- next of kin- nationality- gender

Facebook Custom AudienceIf you have
accepted a place at Nord University, your email address may be disclosed to
Facebook Custom Audience. Facebook will be the data processor, and will delete
your email address after the Custom Audience service has been delivered. They
will not disclose this to any other third parties and will not use your
personal data to build a profile. Facebook will carry out a matching process
between the email address and its membership database. You may then receive
information customised to you as a student - for example, relating to the study location where you have accepted a study offer, as well as useful information for
students.The
legal basis for this processing is Art. 6, No. 1, Subsection F of GDPR, relating
to legitimate interests.

Security around your personal data

Nord University regularly conducts risk- and vulnerability analyses in order to safeguard your personal data. In addition, security measures have been implemented, such as access controls to prevent more employees than necessary from accessing your personal data. Employees who process personal data are subject to a confidentiality obligation and are given training in privacy protection. All registrations are logged.

Your rights

Right to information and access to information You are entitled to information on how Nord University processes your personal data. This Data Privacy Policy is intended to include the information that you are entitled to obtain.

You are also entitled to see/access information in respect of personal data recorded about you at Nord University. You are also entitled to receive a copy of your personal data if you wish.

Right of correction You have the right to have corrected any incorrect personal data about yourself. You also have the right to have supplemented any incomplete personal data about yourself. If you believe we have registered incorrect or incomplete personal data about you, please contact us. It is important that you state the reasons and, if appropriate, document why you believe that the personal data is incorrect or incomplete.

Right to limit processingIn certain cases you may be entitled to require that the processing of your personal data should be limited. Limitation of personal data means that your personal data will still be stored, but that the possibilities for further use and processing will be limited.

If you believe that your personal data is incorrect or incomplete, or you have objected to the processing (see more about this below), then you are entitled to require that your personal data should be temporarily limited. That means that processing will be limited until we have either corrected your personal data, or have been able to assess whether your objection is justified.

In other cases, you may also be able to require a more permanent limitation of your personal data. In order to be entitled to require the limitation of your personal data, the terms of the Personal Data Act and GDPR article 18 must be met. If we receive a request from you regarding the limitation of personal data, we will consider whether the legal provisions are being met.

Right to erasureIn certain cases, you can require that we delete personal data about you. The right to erasure is not an unconditional right, and whether or not you have the right to erasure must be considered in the light of the Personal Data Act and the Privacy Protection Regulation. If you wish to have your personal data deleted, please contact us. It is important that you state the reason why you want your personal data to be deleted, and if possible, which personal data you would like to have deleted. We will then consider whether the legal conditions for requiring erasure are met. Please note that, in some cases, legislation allows us to make exceptions to the right to erasure. For example, this would be the case when we are obliged to store your personal data to fulfil a task that is required by the Universities and University Colleges Act, or to safeguard important societal interests such as archiving, research and statistics.

Right to present an objectionYou may have the right to present an objection to the processing, i.e. to protest against the processing, if you have a special need for the processing of your personal data to be stopped. Examples might be if you have a need for protection, a secret address, or the like. The right of objection is not an unconditional right, and it depends on the legal basis for the processing, and whether you have a special need. The conditions are set out in GDPR article 21. If you present an objection to the processing, we will consider whether the conditions for presenting an objection are met. If we determine that you have the right to object to the processing, and that the objection is justified, we will stop the processing and you will then be able to require that the data should be erased. However, please note that in certain cases we would not be allowed to erase your data. This could be the case, for example, when we are obliged to store your personal data to fulfil a task that is required by the Universities- and University Colleges Act, or to safeguard important societal interests.

Right lodge a complaint in respect of the processingIf you believe we have not processed your personal data in a correct and lawful manner, or if you believe that we have failed to fulfil your rights, you have the possibility to object to the processing. You can find information about how to contact us in Point 11.

If we do not accept your complaint, you have the possibility to present your complaint to the Norwegian Data Protection Authority. The Data Protection Authority is responsible for verifying that Norwegian enterprises comply with the provisions of the Personal Data Act and the GDPR regulations for the processing of personal data.

Contact

Data Controller

If you wish to make use of your rights, have any questions or need advice regarding the processing of personal data at Nord, please contact behandlingsansvarlig@nord.no. We will deal with your inquiry without unnecessary delay, and no later than within 30 days.

Data Protection Officer

Nord University has a Data Protection Officer to protect the personal privacy interests of everyone on whom the University has recorded information.

personvernombud@nord.noPhone+47 74 02 27 50.

Service providers

The Norwegian Directorate for ICT and Joint Services in Higher Education and Research (Unit) provides FS. This means that Unit develops and manages FS and is responsible for its day-to-day running. This work means that certain indivdiuals at Unit have access to personal data registered in FS and to data sent to and from FS.